Changeset 95

Show
Ignore:
Timestamp:
30/05/05 14:45:55 (4 years ago)
Author:
davea
Message:

Fixed two bugs - users can now only update posts that belong to them.
Also did a bit of tidying and neatening in the admin interface+code.

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • TODO

    r94 r95  
    44---------------- 
    55* Fix login process - password errors currently result in the login box being printed in the wrong place 
    6 * CRITICAL - any user can edit any other user's blog entries 
    7 * SEVERE   - blog entry short-titles should not have to be unique across the whole blog system - they should use the username too 
     6 
     7Bugs that have been fixed 
     8------------------------- 
     9* Fixed in rev 95: CRITICAL - any user can edit any other user's blog entries 
     10* 95: SEVERE   - blog entry short-titles should not have to be unique across the whole blog system - they should use the username too 
    811 
    912New Features 

  • admin.lib.php

    r93 r95  
    236236                } 
    237237                //sanitise subject (make sure it's not a number!) 
    238                 if (isset($_POST['subject']) && trim($_POST['subject']) != "" && (int)$_POST['category'] != 0) { 
     238                if (isset($_POST['subject']) && trim($_POST['subject']) != "") { 
    239239                        $subject = addslashes(trim(strip_tags($_POST['subject']))); 
    240240                } else { 
    …… 
    250250                if (!$this->inputError) { 
    251251                        //check to see this post exists 
    252                         $sql = db_query("SELECT id from entries where shortsubject = '".$id."';"); 
     252                        $sql = db_query("SELECT id from entries where shortsubject = '".$id."' AND user_id='".$this->id."';"); 
    253253                        $sqlNum = db_num_rows($sql); 
    254254                        //yes?, we can update it then.. 
    255255                        if ($sqlNum == 1) {  
    256                                 $sql = db_query("UPDATE entries SET category = {$category}, subject = '{$subject}', body = '{$body}' WHERE shortsubject = '{$id}';");                  
     256                                $sql = db_query("UPDATE entries SET category = {$category}, subject = '{$subject}', body = '{$body}' WHERE shortsubject = '{$id}' AND user_id = '".$this->id."';");                    
    257257                                if (!$sql) { 
    258258                                        error(2,"Database commit failed - ".db_error()); 
    …… 
    277277        { 
    278278                $id = $this->blog->makeCleanString($id); 
    279                 $sql = db_query("SELECT subject, category, body, shortsubject from entries where shortsubject = '".$id."';"); 
     279                $sql = db_query("SELECT subject, category, body, shortsubject from entries where shortsubject = '".$id."' AND user_id = '".$this->id."';"); 
    280280                $sqlNum = db_num_rows($sql); 
    281281                //yes? we can update it then.. 
    …… 
    283283                        $row = db_getrow($sql); 
    284284                        $this->printEntryForm($row,true,true); 
    285                 } 
     285                } else { 
     286            error(2, _("Could not find the requested entry.")); 
     287        } 
    286288        } 
    287289 
    …… 
    308310                echo "<select name=\"category\" id=\"category\">"; 
    309311                //pull in the list of catogories from the database 
    310                 $sql = db_query("SELECT id, name FROM categories"); 
     312                $sql = db_query("SELECT id, name FROM categories ORDER BY name ASC;"); 
    311313                while ($sqlRow = db_getrow($sql)) { 
    312                         echo "<option value=\"{$sqlRow['id']}\"".(((int)$row['category'] == $sqlRow['id']) ? "selected" : "").">{$sqlRow['name']}</option>"; 
     314                        echo "<option value=\"{$sqlRow['id']}\"".(((int)$row['category'] == $sqlRow['id']) ? " selected=\"selected\"" : "").">{$sqlRow['name']}</option>\n"; 
    313315                        } 
    314316                echo "</select>";